KR102023777B1 - Method for network inspection saving packet and system performing the same - Google Patents

Abstract

Disclosed are a system capable of gradually generating a flow and a session by collecting packets on a network, conducting a traffic inspection only with a small number of packets based on generated information, and searching for a packet at a high speed while reducing a packet storage capacity, and a method thereof. According to an embodiment of the present invention, the network inspection method includes: a step in which a network inspection system receives a plurality of packets from a network; a step in which the network inspection system generates a plurality of flows formed by the packets based on the packets; a step in which the network inspection system extracts at least one session formation flow forming the same session from the flows based on information about the flows; a step in which the network inspection system specifies session information about the session based on information about the extracted session formation flow; and a step in which the network inspection system stores the specified session information and a payload of K bytes (here, K is a natural number) included in the session by matching the information with the payload.

Description

Method for network inspection saving packet and system performing the same

The present invention relates to a network inspection method for performing packet storage and a network inspection system for performing the same. More specifically, flows and sessions can be generated step by step by collecting packets on the network, and traffic inspection can be performed with only a small amount of packets based on the generated information, and the packets can be searched at high speed while reducing the storage capacity of the packets. The present invention relates to a system and a method thereof.

Existing network control and management devices are based on packet information of a transport layer protocol (TCP) / UDP (user datagram protocol) or an IP (Internet protocol), such as routing, quality of service (QoS), Efforts have been made to achieve Distributed Denial of Service (DDoS) prevention. However, the packet-based approach ignores the information related to the communication relationship of the upper applications and relies only on the information contained in each separate packet, which is a temporary information transmission unit, thereby reducing the processing speed and largely the applicability. Due to their limitations, they are offered in the form of a single system for independent goals such as routers for packet routing, dedicated systems to defend against DDoS attacks, or deep packet inspection (DPI) systems for traffic control. Among these, the DPI system adopts a method of finding and detecting well-known port numbers and payload signatures used by a specific application or client (eg, a P2P client), and controlling the detected packets. Doing. By detecting these signatures, it is known which client, i.e., the application, is currently generating and / or transmitting packets in the network, and performs appropriate network control in accordance with certain policies.

However, the conventional DPI system has a disadvantage in that the processing overhead is too large because the payload of every packet to be transmitted must be checked. In other words, high speed and expensive equipment is required to detect payloads of all packets. In addition, when the payload is an encrypted packet, the signature may not be detected because there is no way to solve the encryption. In addition, even if it is not encrypted, there is no guarantee that the signature is necessarily found, and there is a problem that it is difficult to find all the signatures.

In order to solve this problem, the present inventor has filed a Korean patent application (Application No. 10-2011-0019891, "Network inspection system and its providing method").

However, since such a first-generation application generates only flows based on packets, there is a problem in that session information is not known. In addition, compared to sessions, flows have to be very large, so that a large number of packets are stored, such as a network recording system. There is a problem that it takes a lot of time to perform.

In order to solve this problem, the present inventors have proposed a method of storing the preceding packet of the initial part of the packets forming the session and performing a security check for it (hereinafter, referred to as a 'prior method') Korean Patent Application No. 10-2015 Proposed by -0020375. However, in the conventional scheme, when an attacker attempts to attack after transmitting a packet (for example, a TCP SYN packet) that does not include a payload several times, there is a problem of not detecting this.

Korean patent application (application number 10-2008-0126888, "Network control system and network control method") Korean patent application (Application No. 10-2011-0019891, "Network inspection system and its provision method") Korean Patent Application (Application No. 10-2015-0020375, "Network Inspection System for Packet Storage and Its Provision Method")

The present invention has been made to solve the above problems, and the technical problem to be achieved by the present invention is to read and examine the packet in real time to store only the first partial packet of the session and to effectively perform a security check on the packet and To provide that system.

In addition, the present invention provides a method and system capable of significantly reducing the number of packets stored in recording network traffic and supporting high-speed packet search.

In particular, the present invention provides a method and system that can cope with an attack in which an attacker sends a packet several times at the beginning of a session that does not contain any information (payload).

According to an aspect of the present invention, a network inspection system, comprising: receiving a plurality of packets from a network; Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets; Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows; Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And associating and storing specific session information with a payload of K bytes (where K is a natural number) included in the session.

In one embodiment, the step of storing the specific session information in association with a preceding payload of K bytes (where K is a natural number) included in the session may include: firstly including a payload of packets constituting the session. Specifying a payload packet of; And correspondingly storing the specific session information and M subsequent packets from the first payload packet of the packets constituting the session, wherein M is stored in the M packets from the first payload packet. It may be the smallest natural number whose payload size is greater than or equal to K bytes, where K is a natural number.

In an embodiment, the storing of the specific session information and the payload of K bytes (where K is a natural number) included in the session may include: storing the specific session information and initial M preceding packets of the session. And storing Ms as corresponding to each other, wherein M may be the smallest natural number whose payload size included in M packets from the first packet of the session is equal to or larger than K bytes (where K is a natural number).

In one embodiment, the step of storing the specific session information and the payload of K bytes (where K is a natural number) included in the session may correspond to the specific session information and the N th packet of the session (where N corresponds to M subsequent packets from the natural number, where M is the size of the payload contained in the M subsequent packets from the N th packet of the session, where K is the byte. Natural water).

In one embodiment, the step of storing the specific session information and a payload of K bytes (where K is a natural number) included in the session may correspond to the specific session information and M from the Nth packet of the session. And storing the subsequent packets correspondingly, where N is the smallest natural number whose payload size included in the N subsequent packets from the first packet of the session is at least G bytes, where G is a natural number, M may be the smallest natural number whose payload size included in M subsequent packets from the Nth packet of the session is equal to or greater than K bytes (where K is a natural number).

According to another aspect of the invention, the network inspection system, receiving a plurality of packets from the network; Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets; Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows; Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And associating and storing specific session information with M packets (where M is a natural number) included in the session.

In one embodiment, the storing of the specific session information and the M packets included in the session (where M is a natural number) may include: storing the specific session information and an Nth packet included in the session (where , N is a natural number).

In one embodiment, the step of storing the specific session information and M packets included in the session (where M is a natural number) in correspondence may include the specific session information and M from the Nth packet included in the session. And storing the corresponding subsequent packets, where N is the smallest natural number whose payload size contained in the N subsequent packets from the first packet of the session is greater than or equal to G bytes, where G is a natural number. have.

In one embodiment, the network inspection method may further include performing, by the network inspection system, a security inspection on the payload of K bytes.

In one embodiment, the network inspection method may further include performing, by the network inspection system, a security inspection on the N packets.

In an embodiment, the session information may include identification information of the at least one session establishment flow forming the session.

In one embodiment, the network inspection method may further comprise storing flow information for each of the at least one session establishment flow.

In one embodiment, the network inspection method comprises: receiving a packet search request stored in the storage device; Specify session information corresponding to the packet search in response to the packet search request, specify a session formation flow corresponding to the packet search based on the specified session information, and determine the packet search based on the specified session formation flow The method may further include extracting a packet corresponding to the request.

According to another aspect of the present invention, there is provided a recorded computer program installed in a data processing apparatus for performing the above-described method.

According to another aspect of the invention, a flow generation module for generating a plurality of flows formed by the plurality of packets based on a plurality of packets received from the network; Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows, and extracting at least one session forming flow based on the extracted information about the at least one session forming flow There is provided a network inspection system including a session generation module for specifying session information and associating and storing particular session information with a payload of K bytes (where K is a natural number) included in the session.

In one embodiment, the session creation module specifies a first payload packet including a payload among the packets constituting the session, specifies the specific session information and the first payload among the packets constituting the session. Store M subsequent packets from the packets correspondingly, where M may be the smallest natural number whose payload size contained in the M packets from the first payload packet is greater than or equal to K bytes (where K is a natural number). .

In one embodiment, the session generation module stores the specific session information and the initial M preceding packets of the session in correspondence, wherein M is a value of a payload included in the M packets from the first packet of the session. It may be the smallest natural number that is at least K bytes in size, where K is a natural number.

In one embodiment, the session generation module associates the particular session information with M subsequent packets from the Nth packet of the session, where N is a natural number, where M is the Nth of the session. The payload included in the M subsequent packets from the packet may be the smallest natural number of K bytes or more, where K is a natural number.

In one embodiment, the step of storing the specific session information and a payload of K bytes (where K is a natural number) included in the session may correspond to the specific session information and M from the Nth packet of the session. And storing the subsequent packets correspondingly, where N is the smallest natural number whose payload size included in the N subsequent packets from the first packet of the session is at least G bytes, where G is a natural number, M may be the smallest natural number whose payload size included in M subsequent packets from the Nth packet of the session is equal to or greater than K bytes (where K is a natural number).

According to another aspect of the invention, a flow generation module for generating a plurality of flows formed by the plurality of packets based on a plurality of packets received from the network; Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows, and extracting at least one session forming flow based on the extracted information about the at least one session forming flow A network inspection system is provided that includes a session generation module that specifies session information, and associates specific session information with M packets included in the session, where M is a natural number.

In one embodiment, the session generation module may store the specific session information in association with M subsequent packets from an N th packet (where N is a natural number) included in the session.

In one embodiment, the session generation module stores the specific session information and M subsequent packets from the Nth packet included in the session, where N is N subsequent packets from the first packet of the session. May be the smallest natural number whose payload is greater than or equal to G bytes, where G is a natural number.

In one embodiment, the network inspection system may further include a security inspection module for performing a security inspection on the payload of K bytes.

In one embodiment, the network inspection system may further include a security inspection module for performing a security inspection on the N packets.

The session information may include identification information of the at least one session formation flow for forming the session, and the flow generation module may store flow information for each of the session formation flows. Can be.

In one embodiment, the network inspection system receives a packet search request of a packet stored by the network inspection system, specifies session information corresponding to the packet search in response to the packet search request, and specifies the specified session information. The apparatus may further include a packet search module configured to specify a session establishment flow corresponding to the packet search based on the first and to extract a packet corresponding to the packet search request based on the specified session establishment flow.

According to the technical idea of the present invention, it is possible to generate information about a flow and a session based on a flow while inspecting a packet at a high speed, so that only an initial part of the packets constituting the session can be inspected in real time in a high speed network environment. There is an effect that a security check can be performed.

In addition, the number of packets stored for recording a network can be significantly reduced, and high speed packet search can be supported based on session information and flow information.

It also has the effect that an attacker can cope with an attack in which the attacker sends a packet several times without any information (payload) at the beginning of the session.

It also has the effect that an attacker can cope with an attack that sends an attack after sending a normal packet at the beginning of the session.

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.
BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.
1 is a view showing a schematic configuration of a network inspection system according to an embodiment of the present invention.
2 is a diagram illustrating a session, a flow, and a packet for a network inspection method according to an embodiment of the present invention.
3 is a diagram illustrating a concept of performing a packet search according to a network inspection method according to an embodiment of the present invention.
FIG. 4 is a diagram for describing a method of storing a first preceding payload of a predetermined size in a specific session in a network checking method according to an embodiment of the present invention.
FIG. 5 is a diagram illustrating a method of storing a predetermined size or number of packets from the middle of a session in a network checking method according to another embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this specification, terms such as "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described in the specification, one or more other It is to be understood that the present invention does not exclude the possibility of the presence or the addition of features, numbers, steps, operations, components, parts, or a combination thereof.

In addition, in the present specification, when one component 'transmits' data to another component, the component may directly transmit the data to the other component, or through at least one other component. Means that the data may be transmitted to the other component. On the contrary, when one component 'directly transmits' data to another component, it means that the data is transmitted from the component to the other component without passing through the other component.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 is a view showing a schematic configuration of a network inspection system according to an embodiment of the present invention. The network inspection system may perform a network inspection method according to the spirit of the present invention.

Referring to FIG. 1, the network inspection system 100 according to an exemplary embodiment of the present invention includes a flow generation module 120 and a session generation module 130. The network inspection system 100 may further include a packet extraction module 110. In addition, the network inspection system 100 may further include a packet search module 140. In addition, the network inspection system 100 may further include a security inspection module 150 and / or storage device (160).

In one embodiment, the network inspection system 100 may be a communication device configuring a network by connecting a plurality of network units. The network inspection system 100 may be a hub, an access point, a router, or the like. Alternatively, the network inspection system 100 may be a system connected to such a communication device (hub, access point, router, etc.).

The network inspection system 100 may include hardware resources and / or software necessary to implement the technical idea of the present invention, and means one physical component or one device. no. That is, the network inspection system 100 may mean a logical combination of hardware and / or software provided to implement the technical idea of the present invention. If necessary, the network inspection system 100 may be installed in devices spaced apart from each other. It may be implemented as a set of logical configurations for implementing the technical idea of the present invention by performing. In addition, the network inspection system 100 may refer to a set of components that are separately implemented for each function or role for implementing the technical idea of the present invention.

In the present specification, the module may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware. For example, the module may mean a logical unit of a predetermined code and a hardware resource for performing the predetermined code, and means a physically connected code or does not necessarily mean one kind of hardware. It can be easily inferred by the average expert in the art.

The storage device 160 may be a device for storing data and / or information necessary to implement the technical idea of the present invention. In one embodiment, the storage device 160 may be a database, non-volatile storage (eg, HDD, SDD, etc.).

The packet extraction module 110 may receive a plurality of packets from a network. The packet extraction module 110 may be installed at a predetermined position on the network to collect packets moving through the network. According to an example, the packet extracting module 110 may be implemented on the network in a tapping mode that receives the packets from a device tapping packets from the network as shown in FIG. 1, but is not limited thereto. The packets can be applied to the packet extraction module in any other way.

It may be implemented on the network in an in-line mode to move on the network through the packet extraction module 110.

The packet extraction module 110 may, for example, be located at the front end and / or the rear end of a gateway existing on a predetermined local area network (LAN) to collect network data according to the spirit of the present invention. The network inspection system 100 may then control the network / traffic according to the inspection result. Controlling the network / traffic may refer to artificial actions such as adjusting bandwidth, transmission rate or blocking transmission for each session, flow, and / or packet. The packet extraction module 110 may be implemented with, for example, a predetermined network interface card (NIC), but is not limited thereto.

The flow generation module 120 may generate a plurality of flows based on the packets received by the packet extraction module 110. The packet extraction module 110 may sequentially output packets to the flow generation module 120. Then, the flow generating module 120 may generate a flow. Generating a flow may mean generating flow information as described below. According to an embodiment, the flow generation module 120 may optionally extract the packets included in the flow and store them in the storage device 160. The flow generation module 120 may store all packets corresponding to a predetermined flow, but according to an implementation example, only the first partial packet of the session including the flow may be finally stored as described later. It can also be stored in).

Of course, the flow generation module 120 temporarily stores the flow and all the packets included in the flow in the storage device 160, and selectively stores only a part of the packets stored by the session generation module 130 and the rest. Can also be deleted.

In the present specification, the term "flow" refers to a set of IP packets continuously delivered within a limited time. Thus, IP flows can include the application's address pairs (sender address, sender port number, receiver address, receiver port number), host pairs (sender network address, receiver network address), AS number pairs (sender AS number, receiver AS number), and so on. It can be defined as the flow of IP packets continuously delivered within the limited time specified by. The concept of the flow and the manner of forming the flow is described in detail in the above-mentioned prior art document, so the detailed description thereof will be omitted. In addition, the concept of the flow and the method of generating the flow in the present specification include the technical idea and description disclosed in the above-mentioned prior art document as a reference of the present specification, and may be treated as being included in the description of the present specification.

An example of generating a flow among the attributes of packets may use a 5-tuple. That is, the flow processor 110 may receive packets as inputs on the network to generate a flow, which is a continuous set of packets, or extract some of the packets forming the flow. The conditions for generating a flow or detecting a flow packet are compared with the attributes of the packets (eg, 5-Tuple (Source Address, Destination Address, Source Port, Destination Port, Protocol)) to compare the same attributes (eg, 5-tuple). If a packet having a value) does not exist, a new flow may be created. If a packet having the same value exists, the flow information of the flow may be updated.

A contiguous set of packets does not necessarily mean packets that are physically contiguous, but may be used to mean that an attribute of a packet reached within a time limited time includes the same packet.

The flow information includes 5-tuple information of a packet, and includes a flow size, a duration, that is, a start time (ST) and an end time (ET) of a flow, and a packet count (PC). , Average Packet Size, Average Rate, Flags (eg, special signals for protocols (SYN, FIN, etc.)) and / or follow size. The flow information may be output to the storage device 160 and stored. The flow generation module 120 may store the flow information for a predetermined flow and at least some of the packets included in the flow in the storage device 160 in correspondence with each other. This process may be defined as the flow generation module 120 generating a flow. For example, the flow information and the packets included in the flow may be stored to be physically continuous, or may be stored in various forms that can be easily searched even though they are physically separated, such as a table or a link.

Some of the packets thus stored may be deleted based on the session information generated by the session generation module 130. For example, it may be deleted except for the initial N preceding packets of the session. Or it can be deleted except for the preceding packet which contains the payload of N bytes at the beginning of the session. In some implementations, only flow information may be stored for a specific flow, and packets corresponding to the specific flow may not be stored.

When a plurality of flows are generated by the flow generation module 120, the session generation module 130 may generate a session based on the information on the plurality of flows. Creating a session means extracting flows forming the same session among a plurality of generated flows, generating session information including identification information of the extracted flows, and storing the generated session information in the storage device 160. can do.

In one embodiment, flows and sessions may be created in the following manner.

The flow generation module 120 determines based on the 5-tuple of the packet and corrects the flow information if the packet is included in the remaining flow without being terminated (5-tuple, if the information is the same), and the packet is You can indicate that you are dependent on the flow.

If it is determined based on the 5-tuple information of the packet, if the packet does not belong to a specific flow, a new flow may be generated to indicate that the packet depends on the newly generated flow.

When a new flow is generated, the session generation module 130 determines based on the 5-tuple information of the flow, modifies the corresponding session information when the flow is included in the remaining session without ending the flow, and assigns the flow to the session. You can indicate that you are dependent. If it is determined based on the 5-tuple information of the flow, if it does not belong to a specific session, a new session may be created and the flow may be dependent on the newly created session. If a packet notifying the end of the session is received, the flow and the session including the packet may be terminated and stored in the storage device 160. In the case of a flow or a session that is not terminated, if the packet included in the flow or the session is not received for a predetermined time, the flow and the session may be terminated.

In addition, generating a session may mean storing a part of the packets included in the session together with the session information so as to correspond to the session information. For example, during session establishment, the session generation module 130 may store initial M preceding packets among packets included in the session to correspond to the session information. Alternatively, M subsequent packets from Nth packets among the packets included in the session may be stored to correspond to the session information. Alternatively, the session generation module 130 may store a packet including a payload of an initial K byte of the session among the packets included in the session, together with the session information so as to correspond to the session information. Alternatively, the session generation module 130 may store a subsequent packet including a payload of N bytes to K bytes so as to correspond to the session information. This will be described later in more detail.

The storing of some packets to correspond to the session information may be a process of deleting some of the packets already stored by the flow generation module 120 except for some of the packets. Alternatively, session information and packets may be stored separately. In this case, the packet may be stored in duplicate.

Alternatively, the process of storing some packets to correspond to the session information temporarily stores only the packets to be stored in the volatile memory and discards the packets that are not to be stored, and the packets stored in the volatile memory are terminated at the end of the session. And may be stored at 160.

The concept of generating a session by the session generation module 130 will be described with reference to FIG. 2.

2 is a diagram illustrating a session, a flow, and a packet for a network inspection method according to an embodiment of the present invention.

1 and 2, when sessions S are formed between predetermined devices, the session S may be configured of at least one flow F. Referring to FIG. In addition, the at least one flow may be composed of at least one packet (P), respectively.

According to the spirit of the present invention, the network inspection system 100 may collect packets passing through a point on a predetermined network. This may be performed by the packet extraction module 110.

The network inspection system 100 may generate a flow based on packet attributes (eg, 5 tuples) of the collected packets. The method of generating the flow is as described above. The generation of such a flow may be performed by the flow generating module 120. Each flow may consist of only one packet or may consist of a plurality of packets. In addition, the flow size may be different for each flow.

On the other hand, when the flow is generated in this way, the session generation module 130 may generate a session.

In order to generate a session, the session generation module 130 may check flow information stored in the storage device 160. Flows included in the same session may have common characteristics. Accordingly, the session generation module 130 may search for flows having the common characteristics among the flows stored in the storage device 160. In addition, the temporal priority of each flow can be determined based on the flow information (for example, information of S.T, E.T, etc. included in the flow information). The session generation module 130 may grasp the best flow and the last flow of the session based on the flag information included in the flow information of each session establishment flow.

Therefore, the session generation module 130 may extract at least one flow included in a specific session, that is, session formation flow. The session establishment flow may be one flow or may include a plurality of flows.

As such, the network inspection system 100 according to the spirit of the present invention not only generates a flow but also generates a session based on the generated flow, so that all important characteristics of the session can be identified by data of an initial part of the session. Because it can. Therefore, compared to storing and inspecting all packets for which the prior arts are collected (e.g., DPI), or storing and inspecting a certain number of preceding packets for each flow, a smaller number of security checks can be used to determine the characteristics of a given application or You can check the information you want. In general, it is known that there is no significant difference in the quality of inspection as compared to the inspection of all packets included in the session as much as the inspection of packets in the initial five of the session. Of course, at the discretion of the service subject, all packets of the session may be stored.

In addition, according to the technical idea of the present invention, when the network inspection system 100 provides a network recording service, there is an effect that only a small number of packets can be stored as compared with the prior art. Therefore, there is an effect that a gain in storage can occur.

In addition, in the case of generating a flow from a packet and generating a session using the generated flow as in the technical idea of the present invention, even when a specific service user searches for a packet, high-speed packet search is possible. That is, the network inspection system 100 may store not only the preceding packets (or the payloads of the initial part of the initial part of the session) but all packets collected, in this case, the session information generated by creating the session. By searching first, the session corresponding to the desired packet is searched, the flow corresponding to the desired packet is searched from the searched session, and then the packet is searched based on the found flow, thereby enabling a fast downdrill search. . If you create only flows, you can search packets after performing the number of flows in the worst case, but in the worst case, you can search for the number of sessions in the worst case. This is because the flow and the packet corresponding to the packet can be searched. Of course, this effect still exists even when storing only the initial part of the preceding packet (or the initial part of the payload). In addition, a service user who wants to search for a packet may know information about a session, but may not know information about a flow. Therefore, when a session is created as in the technical spirit of the present invention, an efficient and high speed packet search is enabled in a network recording service.

Referring back to FIG. 1, the session generation module 130 may generate a session based on a plurality of flows generated by the flow generation module 120. That is, session information can be generated.

The session information may include at least one flow included in the session, that is, an index (identification information) of each session formation flow. In addition, various information representing the characteristics of the session may be further included in the session information.

As described above, high-speed packet search may be performed through the generation of the session information, and some packets to be stored may be specified through the generation of the session.

 Referring to FIG. 3, a conceptual structure in which packets of the present invention are stored may be described as follows.

3 is a diagram illustrating a concept of performing a packet search according to a network inspection method according to an embodiment of the present invention.

Referring to FIG. 3, the session generation module 130 may generate a predetermined session as described above. The session information generated through the creation of the session may include at least identification information of the session establishment flow included in the session, as shown in FIG. 3.

The session information may further include information on 5-tuple of the session, start time (S.T) and end time (E.T), packet count (P.C), session size (S.S), and the like.

The packet search module 140 included in the network inspection system 100 may first search for a session corresponding to the packet search request in response to a packet search request received from a terminal (not shown) of a service user. . The packet search request may include at least one information included in the session information. For example, a sender address, a receiver address, time information, and the like may be included in the packet search request.

Then, the packet search module 140 may search for flow corresponding to the packet search request by searching for flow information of each of the session establishment flows included in the session information. When a flow corresponding to the packet search request is searched, the packet search module 140 may easily search for a packet corresponding to the packet search request from the storage device 160. Of course, when the network inspection system 100 stores only the preceding packet according to an embodiment, a packet corresponding to the packet search request may not exist. In addition, when storing all packets, it may be guaranteed that a packet corresponding to a packet search request is searched.

As a result, the technical idea of the present invention is to generate a flow from a packet, generate a session from the flow, and then search for a packet, thereby enabling high-speed downdrill search in the order of session, flow, and packet.

Referring back to FIG. 1, the security check module 150 may perform a security check on packets dependent on each session as described above. The method of performing the security check may vary, for example, a conventional IDS (Intrusion Detection System) or the like may be used. Of course, the test result of the security test module 150 may be stored in the storage device (160). In addition, the security check module 150 may perform the security check only on some packets (eg, the initial N preceding packets of the session) included in the session, not the entire session. The security check may be completed in real time, and thus the network inspection system 100 may perform predetermined network control (eg, blocking, bandwidth adjustment, etc.) for the session.

Meanwhile, according to the spirit of the present invention, as described above, the network inspection system 100 may be used for a network recording service. In the past, network recording had to store all collected packets. However, according to the inventive concept, a session is formed to include some packets of a session (for example, an initial M preceding packet or an initial K byte of payload). By storing only packets, the amount of stored packets can be significantly reduced while important information can be stored. In this case, there is a saving of storage compared to collecting / saving the entire packet.

In addition, according to the spirit of the present invention, the network inspection system 100 may store only packets corresponding to a predetermined type of session. For example, the network inspection system 100 may perform network recording only for a predetermined session such as an HTTP or TCP session. In addition, recording can be performed by using a different storage method for each network service port. For example, you can store no packets at all for packets using port 443, only the initial K bytes of the session for packets using port 80, and all packets for packets using port 22. . It is also possible not to store a packet transmitted or received by a specific IP.

Such a function of performing network recording only for a predetermined session, port, or IP may be performed by the flow generating module 120 or may be generated by the session generating module 130. For example, the flow generation module 120 may generate a flow targeting only packets corresponding to a predetermined session among the packets collected by the packet extraction module 110. Alternatively, after the flow generation module 120 generates a flow for all packets, a flow that does not correspond to a predetermined session among the flows generated by the session generation module 130 may be deleted from the storage device 160. have.

Whether it corresponds to the predetermined session may be determined based on port information of the packets. That is, a port number may be bound according to the type of session, and it may be determined whether a packet or a flow corresponds to a predetermined session based on the port number.

According to an implementation example, the packet extraction module 110 may transmit only a packet corresponding to a predetermined session to the flow generation module 120.

In any case, the network inspection system 100 may perform network recording only for a predetermined session.

As a result, according to the technical concept of the present invention, an absolute amount of packets to be stored may be reduced as compared with a conventional network recording, and network recording may be performed only for a desired session.

The network inspection system 100 according to the spirit of the present invention may store only some packets (for example, packets including an initial payload of K bytes) instead of storing all packets included in a specific session. Therefore, the amount of packets stored in each session can be reduced.

In addition, the network inspection system 100 according to the spirit of the present invention does not store packets for all sessions, but can store only a predetermined type of sessions, and thus, no packets for sessions that do not correspond to a predetermined type. There is an effect that the storage may not be made.

As described above, according to the technical concept of the present invention, it is possible to reduce the absolute amount of packets to be stored and to selectively store only packets that are significant for the security check, thereby enabling high-speed packet search. At the same time, as described above, high-speed packet search is possible through the drill-down search in the order of session information and flow information.

As described above, the network inspection system 100 according to an embodiment of the present invention stores some packets (eg, packets including an initial payload of K bytes) of each session, thereby storing the amount of packets to be stored. Enables high-speed packet search while reducing However, if a network attacker sends out packets that are meaningless, that is, include only headers and no payloads (for example, SYN, ACK, FIN, etc.), the actual attack packets may be a threat to the network. In case of sending a message, a problem may occur that cannot be detected. Therefore, instead of storing the initial N preceding packets of each session, the network inspection system 100 according to another embodiment of the present invention, the initial leading payload of a certain size K bytes or the initial leading pay of K bytes for each session A packet including a load may be stored in association with session information, which will be described with reference to FIG. 4. Here, K may be a predetermined natural number.

4 shows an example in which the initial five packets of the packets constituting the session are packets having only a header, and include payloads from the sixth and subsequent packets.

Will be represented as | hereinafter described as an arbitrary i-th packet of the session S in Fig. 4 P _i, and the size of the packet P _i of the expression is referred to as the payload L _i, and the payload L _i | L _i.

The session generation module 130 included in the network inspection system 100 according to an embodiment of the present invention may store the first packet (or packet payload) including the payload. In addition, the session generation module 130 may store the packet (or the payload of the packet) until the sum of payloads of the stored packets becomes a predetermined K byte.

In the example of FIG. 4, the session generation module 130 may store L ₆ , which is the payload of P ₆ , which is the first packet including the payload. Also in the example of FIG. 4, | L ₆ | + | L ₇ | + | L ₈ | + | L ₉ | + | L ₁₀ | + | L ₁₁ | If = K, the session generation module 130 may store up to L ₁₁ , which is a payload of P ₁₁ .

According to an implementation example, the session generation module 130 may store only the preceding payload, but may also store a packet including the preceding payload. That is, in the example of FIG. 4, the session generation module 130 may store up to P ₁₁ , the packet in which the sum of payloads is K bytes, from P ₆ , which is the first packet including the payload.

On the other hand, when the sum to the middle portion of the payload included in a particular packet is K bytes, depending on the embodiment, only the middle portion of the payload of the packet whose sum is K may be stored, or the entire packet packet may be stored. You can also save everything. That is, in the example of FIG. 5, | L ₆ | + | L ₇ | + | L ₈ | + | L ₉ | + | L ₁₀ | + | L ₁₁ | >K> | L ₆ | + | L ₇ | + | L ₈ | + | L ₉ | + | L ₁₀ | If so, the session generation module 130, i) according to the implementation, i) to store the L ₆ to the middle of L ₁₁ so that the total sum of the size is K bytes, or ii) L ₆ to L ₁₁ , or iii) P ₆ to P ₁₁ can be stored.

Alternatively, according to an implementation example, the session generation module 130 may store a packet including only a header. That is, the session generation module 130 may start storing from the first packet of each session and store until the sum of payloads is K. Referring to FIG. 4 as an example, the session generation module 130 may store P ₁ to P ₁₁ .

Meanwhile, since an attacker should be able to detect a real attack packet that may be a threat to the network after sending some normal packets, another embodiment of the present invention skips some initial packets of a session and then a certain number of times from next time. Packet may be stored, which will be described below with reference to FIG. 5.

FIG. 5 shows an example of skipping initial N packets of a session and storing M packets from the N + 1 th packet. In the example of FIG. 5, N and M may be any natural number.

Expressing any i th packet of session S as P _i , in the embodiment of FIG. 5, the session creation module 130 skips P ₁ to P _{N and} stores P _{1 + 1} to P _{N + M.} Can be.

Meanwhile, M, the number of packets to be stored, may be a predetermined value, but in some embodiments, M may be a value calculated by the size K of the payload to be stored. If the payload of the packet P _i is expressed as L _{i and} the size of the payload L _i is expressed as | L _i |, then M is | L _{n + 1} | + | L _{n + 2} | … + | L _{n + m} | It can be the smallest natural number> = K bytes.

Meanwhile, although N, the number of skipped initial packets, may also be a predetermined value, in some embodiments, it may be a value calculated by the size G (G is a predetermined natural number) of the skipped payload. N is M is | L ₁ | + | L ₂ | … + | L _n | It may be the smallest natural number> = G bytes. Meanwhile, the network inspection system 100 may perform the aforementioned security check and the like on the packet including the preceding payload or the preceding payload stored in the same manner. Of course.

In some implementations, the network inspection system 100 may include at least one processor and a memory storing a program executed by the processor. The processor may include a single core CPU or a multi core CPU. The memory may include fast random access memory and may include nonvolatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other nonvolatile solid state memory devices. Access to memory by the processor and other components may be controlled by the memory controller.

On the other hand, the network test method according to an embodiment of the present invention may be implemented in the form of computer-readable program instructions may be stored in a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored.

The program instructions recorded on the recording medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the software art.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, floppy disks, and the like. Included are hardware devices specifically configured to store and execute the same magneto-optical media and program instructions such as ROM, RAM, flash memory, and the like. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Examples of program instructions include not only machine code generated by a compiler, but also devices that process information electronically using an interpreter, for example, high-level language code that can be executed by a computer.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. .

Claims (26)

delete Receiving, by the network inspection system, a plurality of packets from the network;
Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets;
Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows;
Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And
And storing the corresponding session information and the payload of K bytes (where K is a natural number) included in the session in correspondence.
The step of storing the specific session information and a payload of K bytes (where K is a natural number) included in the session in correspondence with each other may include:
Specifying a first payload packet including a payload among the packets constituting the session; And
Associating and storing the specific session information with M subsequent packets from the first payload packet among packets constituting the session,
Wherein M is the smallest natural number whose payload size contained in the M packets from the first payload packet is equal to or larger than K bytes, where K is a natural number.
delete Receiving, by the network inspection system, a plurality of packets from the network;
Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets;
Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows;
Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And
And storing the corresponding session information and the payload of K bytes (where K is a natural number) included in the session in correspondence.
The step of storing the specific session information and a payload of K bytes (where K is a natural number) included in the session in correspondence with each other may include:
Associating and storing M subsequent packets from the particular session information and the Nth packet of the session, where N is a natural number,
Wherein M is the smallest natural number whose payload size contained in M subsequent packets from the Nth packet of the session is at least K bytes, where K is a natural number.
Receiving, by the network inspection system, a plurality of packets from the network;
Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets;
Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows;
Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And
And storing the corresponding session information and the payload of K bytes (where K is a natural number) included in the session in correspondence.
The step of storing the specific session information and a payload of K bytes (where K is a natural number) included in the session in correspondence with each other may include:
Associating and storing said specific session information with M subsequent packets from the Nth packet of said session,
Where N is the smallest natural number whose payload size contained in the N subsequent packets from the first packet of the session is at least G bytes (where G is a natural number), and M is M subsequent packets from the Nth packet of the session. A network inspection method in which the size of the payload contained in is the smallest natural number of K bytes or more, where K is a natural number.
delete Receiving, by the network inspection system, a plurality of packets from the network;
Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets;
Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows;
Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And
And storing the corresponding session information in correspondence with M packets included in the session, where M is a natural number.
The step of storing the specific session information and M packets included in the session (where M is a natural number) in association with each other may include:
And associating the specific session information with M subsequent packets from an N th packet (where N is a natural number) included in the session.
Receiving, by the network inspection system, a plurality of packets from the network;
Generating, by the network inspection system, a plurality of flows formed by the plurality of packets based on the received plurality of packets;
Extracting, by the network inspection system, at least one session forming flow forming a same session among the plurality of flows based on the information on the generated plurality of flows;
Specifying, by the network inspection system, session information for the session based on the extracted information about the at least one session establishment flow; And
And storing the corresponding session information in correspondence with M packets included in the session, where M is a natural number.
The step of storing the specific session information and M packets included in the session (where M is a natural number) in association with each other may include:
Storing the specific session information in association with M subsequent packets from an Nth packet included in the session,
Where N is the smallest natural number whose payload size contained in the N subsequent packets from the first packet of the session is at least G bytes (where G is a natural number).
The network inspection method according to claim 2, 4 or 5, wherein
And performing, by the network inspection system, a security check on the K bytes of payload.
The method of claim 7 or 8, wherein the network inspection method,
The network inspection system, further comprising performing a security check on the M packets.
The method of claim 2, 4, 5, 7, or 8, wherein the session information,
And identification information of the at least one session establishment flow forming the session.
The method of claim 11, wherein the network inspection method,
Storing flow information for each of the at least one session establishing flow.
The method of claim 12, wherein the network inspection method,
Receiving a packet search request for a packet stored by the network inspection system;
Specify session information corresponding to the packet search in response to the packet search request, specify a session formation flow corresponding to the packet search based on the specified session information, and determine the packet search based on the specified session formation flow Extracting a packet corresponding to the request.
A computer program installed in a data processing apparatus and recorded on a computer readable recording medium for carrying out the method of claim 2, 4, 5, 7, or 8.
delete A flow generation module for generating a plurality of flows formed by the plurality of packets based on the plurality of packets received from a network;
Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows,
Specify session information on the session based on the extracted information on the at least one session establishment flow,
It includes a session generation module for storing the corresponding session information and the payload of K bytes (where K is a natural number) included in the session in association with each other,
The session generation module,
Specifying a first payload packet including a payload among the packets constituting the session,
Storing the specific session information in correspondence with M subsequent packets from the first payload packet among packets constituting the session,
Wherein M is the smallest natural number whose payload size contained in the M packets from the first payload packet is at least K bytes, where K is a natural number.
delete A flow generation module for generating a plurality of flows formed by the plurality of packets based on the plurality of packets received from a network;
Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows,
Specify session information on the session based on the extracted information on the at least one session establishment flow,
It includes a session generation module for storing the corresponding session information and the payload of K bytes (where K is a natural number) included in the session in association with each other,
The session generation module,
Store the corresponding session information in correspondence with M subsequent packets from the Nth packet of the session, where N is a natural number,
Wherein M is the smallest natural number whose payload size contained in M subsequent packets from the Nth packet of the session is at least K bytes, where K is a natural number.
A flow generation module for generating a plurality of flows formed by the plurality of packets based on the plurality of packets received from a network;
Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows,
Specify session information on the session based on the extracted information on the at least one session establishment flow,
It includes a session generation module for storing the corresponding session information and the payload of K bytes (where K is a natural number) included in the session in association with each other,
The session generation module,
Storing the specific session information in association with M subsequent packets from the Nth packet of the session,
Where N is the smallest natural number whose payload size contained in the N subsequent packets from the first packet of the session is at least G bytes (where G is a natural number), and M is M subsequent packets from the Nth packet of the session. The network inspection system, which is the smallest natural number whose payload size is greater than or equal to K bytes, where K is a natural number.
delete A flow generation module for generating a plurality of flows formed by the plurality of packets based on the plurality of packets received from a network;
Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows,
Specify session information on the session based on the extracted information on the at least one session establishment flow,
And a session generation module for storing specific session information and M packets (where M is a natural number) included in the session in correspondence with each other.
The session generation module,
And storing M specific packets in correspondence with the specific session information from an Nth packet included in the session, where N is a natural number.
A flow generation module for generating a plurality of flows formed by the plurality of packets based on the plurality of packets received from a network;
Extracting at least one session forming flow that forms the same session among the plurality of flows based on the generated information about the plurality of flows,
Specify session information on the session based on the extracted information on the at least one session establishment flow,
And a session generation module for storing specific session information and M packets (where M is a natural number) included in the session in correspondence with each other.
The session generation module,
Storing the specific session information and M subsequent packets from the Nth packet included in the session,
Where N is the smallest natural number whose payload size contained in the N subsequent packets from the first packet of the session is at least G bytes (where G is a natural number).
The network inspection system according to claim 16, 18 or 19,
And a security check module for performing a security check on the payload of K bytes.
The network inspection system according to claim 21 or 22,
And a security check module for performing a security check on the M packets.
23. The method of claim 16, 18, 19, 21 or 22, wherein the session information,
Characterized in that it comprises identification information of the at least one session establishment flow forming the session,
The flow generation module,
A network inspection system for storing flow information for each of the session establishment flows.
The system of claim 25, wherein the network inspection system,
Receiving a packet search request of a packet stored by the network inspection system, specifying session information corresponding to the packet search in response to the packet search request, and establishing a session corresponding to the packet search based on the specified session information And a packet search module for specifying a flow and extracting a packet corresponding to the packet search request based on the specified session establishment flow.

Images